CICIDS2017-DOS (PB)

CICIDS2017-DOS (PB) is the perfectly balanced version of the dataset created from the DoS-specific subset of the original CICIDS2017 data. It contains six traffic categories: benign, DDoS, DoS GoldenEye, DoS Hulk, DoS Slowloris, and DoS SlowHTTPTest, represented in equal proportions. The dataset includes 110,573 instances, with 26,064 samples assigned to each of the four largest classes and proportional representation for the remaining two classes based on the median-based sampling rule. All 72 processed numerical features are preserved after preprocessing, including formatted timestamp values, numeric IP encoding, and removal of redundant or null attributes.

This dataset is designed for benchmarking classifier performance under controlled distribution fairness. It is suitable for studies in model comparison, evaluation of classification algorithms without class skew influence, and reproducibility testing. The equal representation of benign and attack traffic allows a consistent evaluation baseline for intrusion detection research.

Cite:

Panigrahi, R., & Borah, S. (2018). A detailed analysis of CICIDS2017 dataset for designing Intrusion Detection Systems. International Journal of Engineering & Technology, 7(3.24), 479-482.

Iman Sharafaldin, Arash Habibi Lashkari, and Ali A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization”, 4th International Conference on Information Systems Security and Privacy (ICISSP), Portugal, January 2018.